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CLAIMS 

An apparatus for controlling safety-critical processes, 
said apparatus comprising: 

a safe control unit for controlling said safety- 
critical processes, 

a plurality of safe signal units each of which hav- 
ing I/O channels for connecting said safe signal 
units to said safety critical processes, and each of 
said signal units being allocated to at least one 
defined group of signal units, and 

a fieldbus, wherein said safe control unit and said 
safe signal units are connected to said fieldbus for 
communication, and wherein said safe signal units 
communicate with said safe control unit, but not 
with one another during faultless control mode, 

wherein each safe signal unit further comprises: 

a transmitter for broadcasting a fault message via 
said fieldbus, when a fault is detected by said sig- 
nal unit, 

an evaluator for evaluating any fault message broad- 
casted by another unit across said fieldbus as to 
its relevance with respect to the safety critical 
processes connected, and 
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a switching device which autonomously changes, via 
said I/O channels, said safety-critical processes 
connected to a safe state when said evaluator evalu- 
ates said general fault message as being relevant, 

wherein said evaluator evaluates said general fault 
message for its relevance to said group to which 
said respective signal unit is allocated. 

The apparatus of Claim 1, wherein groups that are affected 
by a fault are coded in said general fault message. 

An apparatus for controlling safety-critical processes, 
said apparatus comprising: 

a safe control unit for controlling said safety- 
critical processes, 

at least two safe signal units having I/O channels 
which are connected to said safety-critical proc- 
esses, and 

a fieldbus, said safe control unit and said safe 
signal units being connected to said fieldbus for 
communication, 

wherein said safe signal units communicate with said 
safe control unit, but not with one another, when 
said apparatus is in a faultless control mode, and 
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wherein said safe signal units each comprise an 
evaluator for evaluating any general fault message 
broadcasted across said fieldbus, as well as a 
switching device which autonomously changes at least 
one of said safety-critical processes to a safe 
state when a general fault message broadcasted is 
evaluated as being relevant. 

The apparatus of Claim 3, wherein said signal units each 
have a transmitter for broadcasting general fault messages 
across said fieldbus. 

The apparatus of Claim 3, wherein said signal units are 
each allocated to at least one defined group of signal 
units, and said evaluator evaluates said general fault 
message for a relevance with respect to the associated 
group . 

The apparatus of Claim 5, wherein groups that are affected 
by a fault are coded in said fault message. 

The apparatus of Claim 3, wherein said fieldbus provides a 
bus protocol for organizing said communication, said bus 
protocol assigning different transmission priorities to 
said signal units, and wherein said general fault messages 
are always broadcasted with the highest priority, irre- 
spective of the transmission priority assigned to their 
sender . 
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8. The apparatus of Claim 3, wherein said evaluator evaluates 
said fault messages without sending an acknowledgment mes- 
sage. 

9. The apparatus of Claim 3, wherein said signal units fur- 
ther comprise a time monitor for monitoring a timely oc- 
currence of an expected event, said time monitor initiat- 
ing the broadcast of said fault message when said expected 

f;:J event is not timely detected. 

O 

m ^0. The apparatus of Claim 9, wherein said expected event is a 

in reception of an acknowledgment message. 
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11. The apparatus of Claim 9, wherein said expected event is a 
jy reception of a test message which is sent cyclically. 
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JfJ 12. The apparatus of Claim 9, wherein said expected event is a 

transmission window. 



The apparatus of Claim 3, wherein said fieldbus is a CAN 
bus . 

The apparatus of Claim 3, comprising at least two safe 
control units for controlling safety-critical processes, 
said at least two safe control units being connected to a 
plurality of safe signal units via said common fieldbus. 

The apparatus of Claim 14, further comprising an adminis- 
tration unit for co-ordinating said at least two safe con- 
trol units. 
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The apparatus of Claim 14, wherein at least one signal 
unit is associated jointly with said at least two safe 
control units, wherein a first one of said safe control 
units communicates directly with said signal unit, while a 
second one of said safe control units communicates with 
said signal unit via said first control unit. 



